<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#222">
<meta name="generator" content="Hexo 5.0.2">
  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png">
  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32-next.png">
  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16-next.png">
  <link rel="mask-icon" href="/images/logo.svg" color="#222">

<link rel="stylesheet" href="/css/main.css">



<link rel="stylesheet" href="//cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5.14.0/css/all.min.css">
  <link rel="stylesheet" href="//cdn.jsdelivr.net/npm/animate.css@3.1.1/animate.min.css">

<script class="hexo-configurations">
    var NexT = window.NexT || {};
    var CONFIG = {"hostname":"wanglong_kevin.gitee.io","root":"/","scheme":"Gemini","version":"8.0.0-rc.5","exturl":false,"sidebar":{"position":"left","display":"post","padding":18,"offset":12},"copycode":false,"bookmark":{"enable":false,"color":"#222","save":"auto"},"fancybox":false,"mediumzoom":false,"lazyload":false,"pangu":false,"comments":{"style":"tabs","active":null,"storage":true,"lazyload":false,"nav":null},"motion":{"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"fadeInDown","post_body":"fadeInDown","coll_header":"fadeInLeft","sidebar":"fadeInUp"}},"prism":false};
  </script>

  <meta name="description" content="BPF &amp; XDP 知识分享      什么是BPF定义：  BPF(Berkeley Packet Filter) 是Linux内核中一种高度灵活且高效的类虚拟机架构，    允许以安全的方式在各个挂钩点执行字节码。它被用于许多Linux内核子系统，最突出的是网络、    跟踪和安全。">
<meta property="og:type" content="article">
<meta property="og:title" content="BPF &amp; XDP 知识分享">
<meta property="og:url" content="https://wanglong_kevin.gitee.io/2019/09/26/bpf/index.html">
<meta property="og:site_name" content="冬天里的小木屋">
<meta property="og:description" content="BPF &amp; XDP 知识分享      什么是BPF定义：  BPF(Berkeley Packet Filter) 是Linux内核中一种高度灵活且高效的类虚拟机架构，    允许以安全的方式在各个挂钩点执行字节码。它被用于许多Linux内核子系统，最突出的是网络、    跟踪和安全。">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://wanglong_kevin.gitee.io/2019/09/26/bpf/bpf_ar.png">
<meta property="og:image" content="https://wanglong_kevin.gitee.io/2019/09/26/bpf/bpf_py.png">
<meta property="og:image" content="https://wanglong_kevin.gitee.io/2019/09/26/bpf/bpf_tools.png">
<meta property="og:image" content="https://wanglong_kevin.gitee.io/2019/09/26/bpf/xdp_ar.png">
<meta property="og:image" content="https://wanglong_kevin.gitee.io/2019/09/26/bpf/xdp_perf.png">
<meta property="article:published_time" content="2019-09-26T02:52:09.000Z">
<meta property="article:modified_time" content="2019-09-27T09:37:07.000Z">
<meta property="article:author" content="Kevin">
<meta property="article:tag" content="linux bpf">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://wanglong_kevin.gitee.io/2019/09/26/bpf/bpf_ar.png">


<link rel="canonical" href="https://wanglong_kevin.gitee.io/2019/09/26/bpf/">


<script class="page-configurations">
  // https://hexo.io/docs/variables.html
  CONFIG.page = {
    sidebar: "",
    isHome : false,
    isPost : true,
    lang   : 'zh-CN'
  };
</script>

  <title>BPF & XDP 知识分享 | 冬天里的小木屋</title>
  






  <noscript>
  <style>
  body { margin-top: 2rem; }

  .use-motion .menu-item,
  .use-motion .sidebar,
  .use-motion .post-block,
  .use-motion .pagination,
  .use-motion .comments,
  .use-motion .post-header,
  .use-motion .post-body,
  .use-motion .collection-header {
    visibility: visible;
  }

  .use-motion .header,
  .use-motion .site-brand-container .toggle,
  .use-motion .footer { opacity: initial; }

  .use-motion .site-title,
  .use-motion .site-subtitle,
  .use-motion .custom-logo-image {
    opacity: initial;
    top: initial;
  }

  .use-motion .logo-line {
    transform: scaleX(1);
  }

  .search-pop-overlay, .sidebar-nav { display: none; }
  .sidebar-panel { display: block; }
  </style>
</noscript>

</head>

<body itemscope itemtype="http://schema.org/WebPage" class="use-motion">
  <div class="headband"></div>

  <main class="main">
    <header class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-container">
  <div class="site-nav-toggle">
    <div class="toggle" aria-label="切换导航栏">
        <span class="toggle-line"></span>
        <span class="toggle-line"></span>
        <span class="toggle-line"></span>
    </div>
  </div>

  <div class="site-meta">

    <a href="/" class="brand" rel="start">
      <i class="logo-line"></i>
      <h1 class="site-title">冬天里的小木屋</h1>
      <i class="logo-line"></i>
    </a>
      <p class="site-subtitle" itemprop="description">The Winter Room</p>
  </div>

  <div class="site-nav-right">
    <div class="toggle popup-trigger">
    </div>
  </div>
</div>



<nav class="site-nav">
  <ul class="main-menu menu">
        <li class="menu-item menu-item-home">

    <a href="/" rel="section"><i class="fa fa-home fa-fw"></i>首页</a>

  </li>
        <li class="menu-item menu-item-tags">

    <a href="/tags/" rel="section"><i class="fa fa-tags fa-fw"></i>标签</a>

  </li>
        <li class="menu-item menu-item-categories">

    <a href="/categories/" rel="section"><i class="fa fa-th fa-fw"></i>分类</a>

  </li>
        <li class="menu-item menu-item-archives">

    <a href="/archives/" rel="section"><i class="fa fa-archive fa-fw"></i>归档</a>

  </li>
  </ul>
</nav>




</div>
        
  
  <div class="toggle sidebar-toggle">
    <span class="toggle-line"></span>
    <span class="toggle-line"></span>
    <span class="toggle-line"></span>
  </div>

  <aside class="sidebar">

    <div class="sidebar-inner sidebar-nav-active sidebar-toc-active">
      <ul class="sidebar-nav">
        <li class="sidebar-nav-toc">
          文章目录
        </li>
        <li class="sidebar-nav-overview">
          站点概览
        </li>
      </ul>

      <!--noindex-->
      <section class="post-toc-wrap sidebar-panel">
          <div class="post-toc animated"><ol class="nav"><li class="nav-item nav-level-1"><a class="nav-link" href="#BPF-amp-XDP-%E7%9F%A5%E8%AF%86%E5%88%86%E4%BA%AB"><span class="nav-number">1.</span> <span class="nav-text"> BPF &amp; XDP 知识分享 </span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#%E4%BB%80%E4%B9%88%E6%98%AFBPF"><span class="nav-number">1.1.</span> <span class="nav-text">什么是BPF</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%AE%9A%E4%B9%89%EF%BC%9A"><span class="nav-number">1.1.1.</span> <span class="nav-text">定义：</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#cBPF%E5%BA%94%E7%94%A8%E7%A4%BA%E4%BE%8B%EF%BC%9Atcpdump-d-i-enp0s3-tcp"><span class="nav-number">1.1.2.</span> <span class="nav-text">cBPF应用示例：tcpdump -d -i enp0s3 tcp</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#cBPF-amp-eBPF"><span class="nav-number">1.1.3.</span> <span class="nav-text">cBPF &amp; eBPF</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#BPF-%E6%B5%81%E7%A8%8B%E5%9B%BE"><span class="nav-number">1.1.4.</span> <span class="nav-text">BPF 流程图</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E6%80%BB%E7%BB%93%EF%BC%9A"><span class="nav-number">1.1.5.</span> <span class="nav-text">总结：</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E4%BB%80%E4%B9%88%E6%98%AFXDP"><span class="nav-number">1.2.</span> <span class="nav-text">什么是XDP</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E5%AE%9A%E4%B9%89"><span class="nav-number">1.2.1.</span> <span class="nav-text">定义:</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#XDP-%E5%B7%A5%E4%BD%9C%E6%A8%A1%E5%BC%8F"><span class="nav-number">1.2.2.</span> <span class="nav-text">XDP 工作模式</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#XDP-actions"><span class="nav-number">1.2.3.</span> <span class="nav-text">XDP actions</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#XDP-%E4%BD%BF%E7%94%A8%E5%9C%BA%E6%99%AF"><span class="nav-number">1.2.4.</span> <span class="nav-text">XDP 使用场景</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#DPDK%E5%AF%B9%E6%AF%94"><span class="nav-number">1.2.5.</span> <span class="nav-text">DPDK对比</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#XDP-%E6%80%A7%E8%83%BD"><span class="nav-number">1.2.6.</span> <span class="nav-text">XDP 性能</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E6%88%91%E4%BB%AC%E8%83%BD%E7%94%A8XDP%E5%81%9A%E4%BB%80%E4%B9%88"><span class="nav-number">1.3.</span> <span class="nav-text">我们能用XDP做什么</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#references"><span class="nav-number">1.4.</span> <span class="nav-text">references</span></a></li></ol></li></ol></div>
      </section>
      <!--/noindex-->

      <section class="site-overview-wrap sidebar-panel">
        <div class="site-author animated" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image" alt="Kevin"
      src="/images/avatar.jpg">
  <p class="site-author-name" itemprop="name">Kevin</p>
  <div class="site-description" itemprop="description">NOT a coder, but an artist.</div>
</div>
<div class="site-state-wrap animated">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
          <a href="/archives/">
        
          <span class="site-state-item-count">8</span>
          <span class="site-state-item-name">日志</span>
        </a>
      </div>
      <div class="site-state-item site-state-categories">
            <a href="/categories/">
          
        <span class="site-state-item-count">3</span>
        <span class="site-state-item-name">分类</span></a>
      </div>
      <div class="site-state-item site-state-tags">
            <a href="/tags/">
          
        <span class="site-state-item-count">11</span>
        <span class="site-state-item-name">标签</span></a>
      </div>
  </nav>
</div>



      </section>
    </div>
  </aside>
  <div class="sidebar-dimmer"></div>


    </header>

    
  <div class="back-to-top">
    <i class="fa fa-arrow-up"></i>
    <span>0%</span>
  </div>

<noscript>
  <div class="noscript-warning">Theme NexT works best with JavaScript enabled</div>
</noscript>


    <div class="main-inner post posts-expand">
      

      

    
  
  
  <article itemscope itemtype="http://schema.org/Article" class="post-block" lang="zh-CN">
    <link itemprop="mainEntityOfPage" href="https://wanglong_kevin.gitee.io/2019/09/26/bpf/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="image" content="/images/avatar.jpg">
      <meta itemprop="name" content="Kevin">
      <meta itemprop="description" content="NOT a coder, but an artist.">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="冬天里的小木屋">
    </span>

    
    
      <header class="post-header">
        <h1 class="post-title" itemprop="name headline">
          BPF & XDP 知识分享
        </h1>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-calendar"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              <time title="创建时间：2019-09-26 10:52:09" itemprop="dateCreated datePublished" datetime="2019-09-26T10:52:09+08:00">2019-09-26</time>
            </span>
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="far fa-calendar-check"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2019-09-27 17:37:07" itemprop="dateModified" datetime="2019-09-27T17:37:07+08:00">2019-09-27</time>
              </span>

          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">
        <h1 id="BPF-amp-XDP-知识分享"><a href="#BPF-amp-XDP-知识分享" class="headerlink" title=" BPF &amp; XDP 知识分享 "></a><center> BPF &amp; XDP 知识分享 </center></h1><!--details
 <summary>  <font size=5> 什么是BPF </font> </summary>
BPF(Berkeley Packet Filter) 是Linux内核中一种高度灵活且高效的类虚拟机构造，
允许以安全的方式在各个挂钩点执行字节码。
</details>  end tag1 -->   

<h2 id="什么是BPF"><a href="#什么是BPF" class="headerlink" title="什么是BPF"></a>什么是BPF</h2><h3 id="定义："><a href="#定义：" class="headerlink" title="定义："></a>定义：</h3><blockquote>
<p> BPF(Berkeley Packet Filter) 是Linux内核中一种高度灵活且高效的类虚拟机架构，
   允许以安全的方式在各个挂钩点执行字节码。它被用于许多Linux内核子系统，最突出的是网络、
   跟踪和安全。   </p>
</blockquote>
<a id="more"></a>
<h3 id="cBPF应用示例：tcpdump-d-i-enp0s3-tcp"><a href="#cBPF应用示例：tcpdump-d-i-enp0s3-tcp" class="headerlink" title="cBPF应用示例：tcpdump -d -i enp0s3 tcp"></a>cBPF应用示例：tcpdump -d -i enp0s3 tcp</h3><details>  <summary> rawdump </summary> 

<pre><code>static struct sock_filter http_bpf_filter [] = &#123;  
    /* Make sure this is an IP packet... */    
    BPF_STMT (BPF_LD + BPF_H + BPF_ABS, 12),    
    BPF_JUMP (BPF_JMP + BPF_JEQ + BPF_K, ETHERTYPE_IP, 0, 8),  
    /* Make sure it&#39;s a TCP packet... */  
    BPF_STMT (BPF_LD + BPF_B + BPF_ABS, 23),  
    BPF_JUMP (BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_TCP, 0, 6),  
    /* Make sure this isn&#39;t a fragment... */  
    BPF_STMT(BPF_LD + BPF_H + BPF_ABS, 20),  
    BPF_JUMP(BPF_JMP + BPF_JSET + BPF_K, 0x1fff, 4, 0),  
    /* Get the IP header length... */  
    BPF_STMT (BPF_LDX + BPF_B + BPF_MSH, 14),  
    /* Make sure it&#39;s to the right port... */  
    BPF_STMT (BPF_LD + BPF_H + BPF_IND, 16),  
    BPF_JUMP (BPF_JMP + BPF_JEQ + BPF_K, 80, 0, 1),  
    /* If we passed all the tests, ask for the whole packet. */   
    BPF_STMT(BPF_RET+BPF_K, (u_int)-1),  
    /* Otherwise, drop it. */  
    BPF_STMT(BPF_RET+BPF_K, 0),  
&#125;;     </code></pre>
</details>

<details>  <summary> net-next/net/packet/af_packet.c    </summary>    

<pre><code>static int packet_rcv(struct sk_buff *skb, struct net_device *dev,       
        struct packet_type *pt, struct net_device *orig_dev)       
&#123;                                                                        
    +--- 35 lines: struct sock *sk;--------------------------------------   
        snaplen = skb-&gt;len;                                                  

    res = run_filter(skb, sk, snaplen);                                  
    if (!res)                                                            
        goto drop_n_restore;                                             
    if (snaplen &gt; res)                                                   
        snaplen = res;                                                   
    .......
&#125;  
static unsigned int run_filter(struct sk_buff *skb,  
        const struct sock *sk,   
        unsigned int res)   
&#123;  
    struct sk_filter *filter;    
    rcu_read_lock();    
    filter = rcu_dereference(sk-&gt;sk_filter);    
    if (filter != NULL)    
        res = bpf_prog_run_clear_cb(filter-&gt;prog, skb);    
    rcu_read_unlock();    
    return res;    
&#125;    </code></pre>
</details>

<h3 id="cBPF-amp-eBPF"><a href="#cBPF-amp-eBPF" class="headerlink" title="cBPF &amp; eBPF"></a>cBPF &amp; eBPF</h3><ul>
<li><strong>cBPF(Classical BPF):</strong>  <ul>
<li>主要用于网络报文过滤  </li>
<li>少量指令，基于寄存器的调度解释器</li>
<li>过滤器公式 —&gt;  字节码 —&gt;解释器 </li>
</ul>
</li>
<li><strong>eBPF(Extended BPF):</strong>  <ul>
<li>Networking:  XDP, tc, socket progs, kcm, reuseport, …</li>
<li>Tracing:  kprobes, uprobes, tracepoints, …</li>
<li>Security:  seccomp, landlock</li>
<li>可使用c语言</li>
<li>更多的寄存器， 及时编译， 安全验证</li>
<li>更多的hook点</li>
<li>通过BPF MAP 更灵活的交互   </li>
</ul>
</li>
</ul>
<p>在不特指的情况下，BPF 指eBPF。</p>
<h3 id="BPF-流程图"><a href="#BPF-流程图" class="headerlink" title="BPF 流程图"></a>BPF 流程图</h3><p><img src="bpf_ar.png" alt="ar"></p>
   <center>  C -----> LLVM/Clang -------> BPF ------> LOADER -------> 
    JIT  ---------> TC/XDP... (---> OFFLOAD) ----> MAP   </center>

<ul>
<li><p><strong>BPF 程序使用的c是受限制的</strong> </p>
<ul>
<li>没有全局变量，没有循环, 没有const字符串  </li>
<li>在一个对象文件中可能有一个或多个入口点</li>
<li>栈空间限制为512字节</li>
<li>库函数都是内联的，没有函数调用的概念<br>…….<br>C example: tools/testing/selftests/bpf/test l4lb.c</li>
</ul>
</li>
<li><p><strong>编译：</strong><br> 生成bpf对象文件<br> clang -O2 -target bpf -c foo.c -o foo.o </p>
</li>
<li><p><strong>加载</strong>：  
  BPF 程序由应用程序来通过系统调用加载到内核，c/c++、
  golang、python、lua 都有对应的库。
<img src="bpf_py.png" alt="py"></p>
</li>
<li><p><strong>veriﬁer &amp; JIT:</strong><br>  模拟程序执行的所有路径, 一系列的严格检查，
  确保不会使内核crash, 不会有太多循环。<br>  即时编译，在运行时将字节码转化为机器指令，效率更高。</p>
</li>
<li><p><strong>BPF程序类型：</strong>    </p>
</li>
</ul>
<table>
<thead>
<tr>
<th align="center">bpf_prog_type</th>
<th align="center">入口参数</th>
<th align="center">说明</th>
</tr>
</thead>
<tbody><tr>
<td align="center">BPF_PROG_TYPE_SOCKET_FILTER</td>
<td align="center">struct __sk_buff</td>
<td align="center">用于过滤进出口网络报文，功能上和 cBPF 类似。</td>
</tr>
<tr>
<td align="center">BPF_PROG_TYPE_KPROBE</td>
<td align="center">struct pt_regs</td>
<td align="center">用于 kprobe 功能的 BPF 代码。</td>
</tr>
<tr>
<td align="center">BPF_PROG_TYPE_TRACEPOINT</td>
<td align="center">这类 BPF 的参数比较特殊，根据 tracepoint 位置的不同而不同。</td>
<td align="center">用于在各个 tracepoint 节点运行。</td>
</tr>
<tr>
<td align="center">BPF_PROG_TYPE_XDP</td>
<td align="center">struct xdp_md</td>
<td align="center">用于控制 XDP(eXpress Data Path)的 BPF 代码。</td>
</tr>
<tr>
<td align="center">BPF_PROG_TYPE_PERF_EVENT</td>
<td align="center">struct bpf_perf_event_data</td>
<td align="center">用于定义 perf event 发生时回调的 BPF 代码。</td>
</tr>
<tr>
<td align="center">BPF_PROG_TYPE_CGROUP_SKB</td>
<td align="center">struct __sk_buff</td>
<td align="center">用于在 network cgroup 中运行的 BPF 代码。功能上和 Socket_Filter 近似。</td>
</tr>
<tr>
<td align="center">BPF_PROG_TYPE_CGROUP_SOCK</td>
<td align="center">struct bpf_sock</td>
<td align="center">另一个用于在 network cgroup 中运行的 BPF 代码</td>
</tr>
</tbody></table>
<ul>
<li><strong>OFFLOAD:</strong><br>  将BPF指令转换为硬件指令，由硬件直接执行BPF代码。
  目前， Netronome nfp 的网卡支持。</li>
<li><strong>MAP:</strong><br>  用户空间中的应用在内核中辟出一块空间建立起一个数据库用以和 
  eBPF 程序交互(bpf_create_map())；数据库本身以 Key-Value 的形式进行组织，
  无论是从用户空间还是内核空间都可以对其进行访问，两边有着相似的接口。</li>
</ul>
<table>
<thead>
<tr>
<th align="center">Category</th>
<th align="center">Source</th>
<th align="center">Bpf_map_type</th>
<th align="right">用途</th>
</tr>
</thead>
<tbody><tr>
<td align="center">Array</td>
<td align="center">Arraymap.c</td>
<td align="center">BPF_MAP_TYPE_ARRAY<br> BPF_MAP_TYPE_CGROUP_ARRAY <br> BPF_MAP_TYPE_PERF_EVENT_ARRAY <br> BPF_MAP_TYPE_PERCPU_ARRAY <br> BPF_MAP_TYPE_ARRAY_OF_MAPS</td>
<td align="right">实际就是数组，所以所有的 key 必须是整数。</td>
</tr>
<tr>
<td align="center"></td>
<td align="center"></td>
<td align="center">BPF_MAP_TYPE_PROG_ARRAY</td>
<td align="right">该类型是一个特例，主要用于自定义函数，利用 JUMP_TAIL_CALL令跳转。</td>
</tr>
<tr>
<td align="center">Hash</td>
<td align="center">Hashmap.c</td>
<td align="center">BPF_MAP_TYPE_HASH BPF_MAP_TYPE_PERCPU_HASH BPF_MAP_TYPE_LRU_HASH BPF_MAP_TYPE_LRU_PERCPU_HASH BPF_MAP_TYPE_HASH_OF_MAPS</td>
<td align="right"></td>
</tr>
<tr>
<td align="center">Stack Trace</td>
<td align="center">Stackmap.c</td>
<td align="center">BPF_MAP_TYPE_STACK_TRACE</td>
<td align="right">如果 key 值为整数以外的类型必须使用存储特定应用在某一特定时间点的栈状态(包括内核态和用户态)，key 只有两个：分别为内核栈 id 和用户栈 id，利用 bpf_get_stackid()获取;</td>
</tr>
<tr>
<td align="center">Longest Prefix Match Trie</td>
<td align="center">Lpm_trie.c</td>
<td align="center">BPF_MAP_TYPE_LPM_TRIE</td>
<td align="right">基于 Longest Prefix Match 前缀树实现，适宜处理以 CIBR 为键值时的情况。</td>
</tr>
</tbody></table>
<h3 id="总结："><a href="#总结：" class="headerlink" title="总结："></a>总结：</h3><p>  <strong>BPF 是一个基于整个内核的一个大架构，
 而且提供了一系列的方便开发者安全地进行内核开发的方法、机制和技术。</strong><br>BPF原本是为过滤报文来设计，由于其能方便灵活安全的与内核交互的特性，
BPF 在内核跟踪方面的应用枝繁叶茂。
<img src="bpf_tools.png" alt="bpf tools"></p>
<h2 id="什么是XDP"><a href="#什么是XDP" class="headerlink" title="什么是XDP"></a>什么是XDP</h2><h3 id="定义"><a href="#定义" class="headerlink" title="定义:"></a>定义:</h3><blockquote>
<p>XDP or eXpress Data Path provides a high performance, programmable 
  network data path in the Linux kernel as part of the IO Visor Project.<br>  XDP(eXpress Data Path)作为IO Visor项目的一部分，
  在Linux内核中提供了高性能的可编程网络数据路径。 </p>
</blockquote>
<p>XDP基于BPF架构在内核<font size=4><strong>底层</strong></font> 提供了很多可执行bpf程序的hook点，使我们可以很灵活的进行数据包处理。</p>
<p><img src="xdp_ar.png" alt="xdp_ar"></p>
<h3 id="XDP-工作模式"><a href="#XDP-工作模式" class="headerlink" title="XDP 工作模式"></a>XDP 工作模式</h3><ul>
<li>xdpoffload:<br>   作用与NIC，目前只有nfp支持。<br>   ip link set dev eno1 xdpoffload obj prog.o</li>
<li>xdpdrv:<br>   作用于驱动层，内核大部分10G/40G驱动都支持。<br>   ip link set dev eno1 xdp obj prog.o<br>   ip link set dev eno1 xdpdrv obj prog.o   </li>
<li>xdpgeneric:<br>   作用于内核协议栈，与硬件无关。<br>   ip link set dev eno1 xdpgeneric obj prog.o</li>
</ul>
<h3 id="XDP-actions"><a href="#XDP-actions" class="headerlink" title="XDP actions"></a>XDP actions</h3><ul>
<li>XDP_PASS: 放行，走正常流程。</li>
<li>XDP_DROP: 很快的丢弃， 不会alloc skb</li>
<li>XDP_TX: 从同一网卡发送出去</li>
<li>XDP_ABORTED: BPF prg错误，放弃</li>
<li>XDP_FWD: 从其他网卡发送</li>
</ul>
<h3 id="XDP-使用场景"><a href="#XDP-使用场景" class="headerlink" title="XDP 使用场景"></a>XDP 使用场景</h3><ul>
<li>DDoS</li>
<li>防火墙</li>
<li>负载均衡</li>
<li>网络统计</li>
</ul>
<h3 id="DPDK对比"><a href="#DPDK对比" class="headerlink" title="DPDK对比"></a>DPDK对比</h3><p>   相对于DPDK，XDP具有以下优点</p>
<ul>
<li>无需第三方代码库和许可</li>
<li>同时支持轮询式和中断式网络</li>
<li>无需分配大页</li>
<li>无需专用的CPU</li>
<li>无需绕过内核协议栈</li>
</ul>
<h3 id="XDP-性能"><a href="#XDP-性能" class="headerlink" title="XDP 性能"></a>XDP 性能</h3><p><img src="xdp_perf.png" alt="xdp_perf"></p>
<h2 id="我们能用XDP做什么"><a href="#我们能用XDP做什么" class="headerlink" title="我们能用XDP做什么"></a>我们能用XDP做什么</h2><ul>
<li>bypass 协议栈</li>
<li>方便快速的在底层过滤掉我们不需要的报文 </li>
<li>负载均衡 </li>
</ul>
<h2 id="references"><a href="#references" class="headerlink" title="references"></a>references</h2><pre><code>- https://www.iovisor.org/technology/xdp
- https://linux.cn/article-9507-1.html
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=85de8576a0b1    (xdp patch in kernel)
- https://prototype-kernel.readthedocs.io/en/latest/networking/XDP/implementation/userspace_api.html  </code></pre>

    </div>

    
    
    

      <footer class="post-footer">
          <div class="post-tags">
              <a href="/tags/linux-bpf/" rel="tag"># linux bpf</a>
          </div>

        

          <div class="post-nav">
            <div class="post-nav-item">
                <a href="/2019/07/23/linux-nfs/" rel="prev" title="linux 下共享远程文件夹">
                  <i class="fa fa-chevron-left"></i> linux 下共享远程文件夹
                </a>
            </div>
            <div class="post-nav-item">
                <a href="/2020/08/10/scanner/" rel="next" title="一文读懂扫描器">
                  一文读懂扫描器 <i class="fa fa-chevron-right"></i>
                </a>
            </div>
          </div>
      </footer>
    
  </article>
  
  
  



      

<script>
  window.addEventListener('tabs:register', () => {
    let { activeClass } = CONFIG.comments;
    if (CONFIG.comments.storage) {
      activeClass = localStorage.getItem('comments_active') || activeClass;
    }
    if (activeClass) {
      const activeTab = document.querySelector(`a[href="#comment-${activeClass}"]`);
      if (activeTab) {
        activeTab.click();
      }
    }
  });
  if (CONFIG.comments.storage) {
    window.addEventListener('tabs:click', event => {
      if (!event.target.matches('.tabs-comment .tab-content .tab-pane')) return;
      const commentClass = event.target.classList[1];
      localStorage.setItem('comments_active', commentClass);
    });
  }
</script>

    </div>
  </main>

  <footer class="footer">
    <div class="footer-inner">
      

      

<div class="copyright">
  
  &copy; 
  <span itemprop="copyrightYear">2020</span>
  <span class="with-love">
    <i class="user"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">Kevin</span>
</div>
  <div class="powered-by">由 <a href="https://hexo.io/" class="theme-link" rel="noopener" target="_blank">Hexo</a> & <a href="https://theme-next.js.org/" class="theme-link" rel="noopener" target="_blank">NexT.Gemini</a> 强力驱动
  </div>

      








    </div>
  </footer>

  
  <script src="//cdn.jsdelivr.net/npm/animejs@3.2.0/lib/anime.min.js"></script>
<script src="/js/utils.js"></script><script src="/js/motion.js"></script><script src="/js/next-boot.js"></script>

  















  

  

</body>
</html>
